Domain name system request monitoring method, electronic device, and storage medium

Abstract

Embodiments of the present application provide a domain name system request monitoring method, an electronic device and a storage medium, aiming to realize efficient monitoring of DNS requests. The method comprises: a first program acquires network connection information associated with a domain name system (DNS) request by intercepting information obtained in a calling process of a first kernel function, the first kernel function comprising: a kernel function required to be called when a client initiates a DNS request; and a second program obtains a detection result of whether the DNS request is a threat by analyzing the network connection information associated with the DNS request.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a domain name system request monitoring method, an electronic device and a storage medium. BACKGROUND

[0002] The domain name system (DNS) is a service of the Internet, which is a distributed database for mapping domain names and Internet Protocol (IP) addresses, and enables users to access the Internet more conveniently.

[0003] In the process that a user accesses a DNS server through a client, the DNS request initiated by the client is usually monitored to detect threats from malicious software, but the traditional DNS request monitoring method is mainly realized by collecting and analyzing DNS logs, and with the large increase in DNS requests, it is difficult to efficiently monitor the DNS requests. SUMMARY

[0004] In view of the above problems, the embodiments of the present application provide a domain name system request monitoring method, an electronic device and a storage medium, so as to overcome the above problems or at least partially solve the above problems.

[0005] The first aspect of the embodiments of the present application provides a domain name system request monitoring method, which is executed by a target program configured in a client, the target program comprising a first program running in a kernel state and a second program running in a user state, and the method comprises:

[0006] The first program collects network connection information associated with a domain name system (DNS) request by intercepting information obtained in the calling process of a first kernel function, and the first kernel function comprises a kernel function required when the client initiates a DNS request;

[0007] The second program obtains a detection result of whether the DNS request is threatened by analyzing the network connection information associated with the DNS request.

[0008] The second aspect of the embodiments of the present application provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete the communication among each other through the communication bus; the memory is used to store a computer program; and the processor is used to execute the program stored on the memory, so as to realize the domain name system request monitoring method disclosed in the first aspect of the embodiments of the present application.

[0009] In a third aspect, the application provides a computer readable storage medium having stored thereon computer programs / instructions which, when executed by a processor, implement the domain name system request monitoring method according to the first aspect.

[0010] The application has the following advantages: by configuring the first program to intercept information of the first kernel function related to the DNS request, the network connection information required for DNS request threat detection can be collected at the kernel level, so that the information collection position is closer to the information generation position, thereby improving the information collection efficiency in the DNS request monitoring process; and by configuring the second program to analyze the information collected by the first program in a timely manner, the threat detection function of the DNS request is realized, so that the efficient monitoring of the DNS request is realized by the cooperation between the programs running at different working levels (i.e. the kernel mode and the user mode). BRIEF DESCRIPTION OF DRAWINGS

[0011] In order to more clearly illustrate the technical solutions of the application, the following will briefly introduce the drawings needed to be used in the description of the application. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0012] Figure 1 is a step flow chart of a domain name system request monitoring method in the application;

[0013] Figure 2 is a step flow chart of another domain name system request monitoring method in the application;

[0014] Figure 3 is a step flow chart of another domain name system request monitoring method in the application;

[0015] Figure 4 is a structural schematic diagram of a domain name system request monitoring device in the application;

[0016] Figure 5 is a schematic diagram of an electronic device in the application. DETAILED DESCRIPTION

[0017] First, in order to facilitate the understanding of the technical solutions provided by the application, the following briefly describes the main technical concepts related to the embodiments of the application.

[0018] Program: composed of functions (as well as variables and data structures, etc.) with certain functions.

[0019] Kernel mode: also known as kernel space, is mainly used to run operating system programs; programs running in kernel mode (hereinafter referred to as kernel-mode programs) have unrestricted access capabilities, such as being able to access all data in memory and use all hardware resources of the computer.

[0020] User mode, also known as user space, is mainly used to run user programs (i.e., user-written applications). Programs running in user mode (hereinafter referred to as user-mode programs) have limited access capabilities. For example, they can only access memory data in a limited way and are not allowed to access peripheral devices such as hard drives and network cards.

[0021] Kernel functions: These are functions provided by the kernel with predefined functions. The interface of kernel functions is also called a system call. Programs running in user mode can pass relevant requests to the kernel through the interface of the relevant kernel function (i.e., the relevant system call), thereby calling the kernel function to perform relevant processing in kernel mode and returning the processing result to the program.

[0022] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0023] Reference Figure 1 The diagram illustrates a flowchart of a Domain Name System (DNS) request monitoring method according to an embodiment of this application. The DNS request monitoring method is executed by a target program configured on a client. The target program includes a first program running in kernel mode and a second program running in user mode. The method includes the following steps:

[0024] Step S11: The first program intercepts the information obtained by the first kernel function during the call process to collect network connection information associated with the Domain Name System (DNS) request. The first kernel function includes the kernel function to be called when the client initiates the DNS request.

[0025] In a specific implementation, a device such as a service server that needs to access a DNS server can be configured as a client according to actual needs, and the target program is configured for the client. When the client calls the first kernel function, that is, inputs an interface call parameter to the interface of the first kernel function to initiate a DNS request for querying a domain name resolution result from the DNS server, the first program in the target program intercepts information obtained by the first kernel function in this call process. For example, the first program can intercept the interface call parameter obtained by the first kernel function, and / or, after the first kernel function performs relevant processing according to the interface call parameter, the first program can intercept the interface return parameter determined by the first kernel function. Then, the port number (such as the port numbers of the source port and the target port), the protocol type, the queried domain name, and other network connection information associated with the DNS request initiated by the client this time are collected from the intercepted interface call parameter (and / or, the interface return parameter).

[0026] Step S12: The second program obtains a detection result of whether the DNS request is threatened by analyzing the network connection information associated with the DNS request.

[0027] In a specific implementation, the second program in the target program can receive the network connection information sent by the first program, or obtain the network connection information collected by the first program through a data sharing function (such as a shared memory area) between the kernel mode and the user mode. After obtaining the network connection information, the second program can perform threat detection on the corresponding DNS request based on a Domain Generation Algorithm (DGA) detection, a DNS tunnel attack detection, and other threat detection technologies according to the network connection information, and then obtain the detection result of whether the DNS request is threatened.

[0028] It can be understood that, compared with collecting network connection information required for DNS request detection through DNS logs (which are mainly output by the DNS server when performing domain name resolution), the embodiment of the present application introduces a kernel mode program (that is, the first program) into the client to intercept information of a kernel function (that is, the first kernel function) called by the client when initiating a DNS request, so that the network connection information is collected in real time at the generation place of the network connection information, that is, in the kernel space of the client itself. Therefore, the information collection efficiency in the DNS request monitoring process can be greatly improved. Then, a user mode program (that is, the second program) is compiled according to actual threat detection needs to independently implement a DNS request detection function based on network connection information, so that real-time DNS request detection is realized based on real-time collected information. Therefore, with the cooperation between the first program and the second program, the efficiency of DNS request monitoring can be ensured when a large number of DNS requests are initiated by the client.

[0029] By configuring the first program to intercept information of the first kernel function related to the DNS request initiation, the network connection information required for DNS request threat detection can be collected at the kernel level, so that the information collection position is closer to the information generation position, thereby improving the information collection efficiency in the DNS request monitoring process. Then, by configuring the second program to analyze the information collected by the first program in a timely manner, the threat detection function of the DNS request is realized. Thus, by means of the cooperation between the programs running at different working levels (i.e., the kernel mode and the user mode), efficient monitoring of the DNS request is realized.

[0030] Referring to Figure 2 , a step flowchart of another domain name system request monitoring method in the embodiment of the present application is shown, as Figure 2 shown, the method comprises the following steps:

[0031] Step S21: The first program intercepts information obtained in the calling process of the first kernel function to collect network connection information associated with the DNS request, and the first kernel function includes a kernel function required to be called when the client initiates the DNS request.

[0032] In specific implementation, the first kernel function can be set according to the actual application scenario. For example, in the case that the client initiates the DNS request based on the User Datagram Protocol (UDP), the kernel function udp_recvmsg used to receive UDP data can be intercepted as the first kernel function, and the collected data structure body socket (which contains network communication parameters such as protocol type, port number, IP address), domain name and other information can be taken as the network connection information associated with the DNS request.

[0033] Step S22: The first program obtains information of the first process.

[0034] The first process includes a process in the client that has initiated the DNS request.

[0035] In specific implementation, when obtaining the information of the first process, the first program can obtain the identification information of the first process, and / or obtain the description information of the first process.

[0036] For example, the first program can obtain the identification information of the first process, such as the Process Identity Document (PID), the Thread Group Identity Document (TGID), etc., by calling the interface of the relevant kernel function, such as calling bpf_get_current_pid_tgid().

[0037] Step S23: The second program obtains the detection result of whether the DNS request is a threat by analyzing the network connection information associated with the DNS request.

[0038] In a specific implementation, the second program can perform detection on the DNS request according to the network connection information, such as whether there is an access behavior to an abnormal domain name (such as a domain name constructed by malicious software based on DGA), thereby determining whether the DNS request is a threat.

[0039] Step S24: The second program determines the DNS request that is a threat according to the obtained detection result.

[0040] In a specific implementation, the second program can determine whether the DNS request associated with the detection result is a DNS request that is a threat each time a detection result is obtained, and perform step S25 to process the DNS request that is a threat in the case that the DNS request associated with the detection result is a DNS request that is a threat.

[0041] Alternatively, the second program can periodically aggregate the detection results obtained in the recent period, and determine the DNS request that is a threat from the relevant DNS requests according to the detection result obtained each time the aggregation is performed, and then perform step S25 to process the DNS request that is a threat.

[0042] Step S25: The second program screens the process that initiates the DNS request that is a threat from the first process as a second process, and requests the first program to process the second process, wherein the first process includes the process that has initiated the DNS request in the client.

[0043] In a specific implementation, the second program can find the malicious process (i.e., the second process) that initiates the DNS request with a threat according to the identification information, description information, and other information of the first process, and block the malicious process, such as requesting the first program to perform a kill or sleep operation on the malicious process, so as to interrupt the execution of the malicious process and achieve threat blocking. By introducing the capability of threat blocking for DNS request monitoring, the spread and diffusion of malicious behavior can be effectively interrupted, the impact of malicious behavior on the network and data can be reduced, further DNS attacks and intrusions can be prevented, and the abuse of system resources by malicious processes can be prevented.

[0044] For example, the second program can inform the first program of which processes need to be blocked through a function interface send_signal(), and the first program then issues an instruction FGS_SIGKILL to the related processes through the function interface send_signal() to terminate the related processes that initiate the DNS with a threat, thereby achieving threat blocking.

[0045] In some embodiments, the first program described above includes a kernel function required to intercept information, and an extended Berkeley Packet Filter (eBPF) program set. The kernel function required to intercept information at least includes the first kernel function.

[0046] In a specific implementation, a custom eBPF program can be set for the kernel function required to intercept information, such as taking the interface of the kernel function required to intercept information as a hook of the custom eBPF program in the first program. In this way, the event-driven nature of the eBPF program can be used to trigger the running of the custom eBPF program when the interface of the related kernel function is called, so that the interface call parameters and interface return parameters of the kernel function can be intercepted in a timely manner, and the information obtained by the kernel function during the call process can be intercepted in a timely manner, thereby further improving the information collection efficiency.

[0047] It should be noted that eBPF is a technology that can run sandbox programs in the operating system kernel, which is used to safely and effectively extend the capabilities of the kernel without modifying the kernel code or loading kernel modules. The embodiments of the present application implement the related functions of the first program in the form of eBPF program writing, which can effectively reduce the development difficulty.

[0048] In some embodiments, after detecting the network connection information associated with the DNS request with threat, the second program can generate an alarm information to remind the user to handle the DNS request with threat in time, and / or automatically generate a log according to the information associated with the DNS request with threat (such as network connection information, process information or request result, etc.), which can record the source, target, time and other information of the related malicious network connection, so as to facilitate subsequent security analysis and audit, thereby optimizing the network security policy and threat blocking algorithm.

[0049] Referring to Figure 3 As shown in FIG. 3, a flow chart of steps of another domain name system request monitoring method in the embodiments of the present application is shown, and as shown in FIG. 4, the method comprises the following steps: Figure 3

[0050] Step S31: The first program collects network connection information associated with the DNS request by intercepting information obtained in the calling process of a first kernel function, wherein the first kernel function comprises a kernel function required to be called when the client initiates the DNS request.

[0051] Step S32: The first program collects first information, wherein the first information comprises at least one of a request result of the DNS request and information of a first process, and the first process comprises a process in the client which has initiated the DNS request.

[0052] Step S33: The second program obtains a detection result of whether the DNS request has threat by analyzing the network connection information associated with the DNS request and the first information.

[0053] In specific implementation, the second program can perform more comprehensive threat detection on the DNS request in combination with the network connection information and the first information.

[0054] For example, the second program can determine whether the DNS request is threatened by cache poisoning attack or the like by detecting whether the request result is a fake domain name resolution result (such as whether it is a false IP address replaced by malicious software).

[0055] For another example, the second program can find the first process which is marked as a malicious process before or find the first process which has similar description information characteristics with the malicious process by analyzing the PID, command line and other information of the first process, and accordingly determine the DNS request initiated by these first processes as the DNS request with threat.

[0056] ​In this embodiment, by additionally introducing the first information on the basis of the network connection information, the multi-dimension of the information on which the DNS request detection is based is realized, so that the second program can implement more comprehensive threat detection on the DNS request.

[0057] As a possible implementation, the first program collects the request result of the DNS request by intercepting information obtained by the second kernel function in the calling process, and the second kernel function includes a kernel function required when the client receives the request result of the DNS request.

[0058] In specific implementation, the second kernel function can be set according to the actual application scenario, for example, in the case where the first kernel function includes the kernel function udp_recvmsg, the kernel function kretprobe (which is used to perform relevant execution operations after the execution of udp_recvmsg is completed) can be used as the second kernel function to intercept information, so that the first program collects the request result (such as the domain name resolution result of IP address) of the DNS request.

[0059] It should be noted that different information obtained by the kernel function in the calling process usually carries different flag information. For example, when the flag information is 0, it indicates that the relevant data is query request data (corresponding to the interface calling parameter); when the flag information is 1, it indicates that the relevant data is request response data (corresponding to the interface return parameter). When the first program intercepts information of the first kernel function and the second kernel function, the query request data and the request response data obtained can be distinguished according to the flag information, so as to collect the network connection information and the request result of the query request data and the request response data.

[0060] In some embodiments, before the above step S33, the method further includes:

[0061] Step S34: The first program matches the first information associated with the same process and the network connection information associated with the DNS request.

[0062] In specific implementation, the first program matches the network connection information associated with the DNS request initiated by the process with the request result of the DNS request received by the process and / or the information of the process (i.e. the first information), that is, the network connection information associated with the DNS request initiated by the same process and the first information are determined as the mutually matched network connection information and the first information, so that the second program can comprehensively analyze each information collected by the first program from the granularity of the DNS request (such as abnormal domain name detection at the level of the DNS request) or the granularity of the process (such as comparison of malicious process description information features at the level of the process).

[0063] Step S35: The first program concatenates the first information that matches each other and the network connection information associated with the DNS request, and sends the concatenated information to the second program.

[0064] In specific implementation, the first program combines the first information that matches each other with the network connection information associated with the DNS request, that is, the network connection information associated with the DNS request initiated by the same process, as well as the request result and / or process information, into one piece of information, and sends the combined information to the second program through data transmission methods between kernel mode and user mode, such as memory copying and memory mapping.

[0065] Step S36: The second program filters the various pieces of information that have been spliced ​​together.

[0066] In practical implementation, the second program can filter the concatenated information based on one or more pieces of information in the concatenated information. For example, the second program can filter out concatenated information related to querying intranet domain names based on network connection information in the concatenated information, and / or, the second program can filter out concatenated information associated with processes in a preset process whitelist based on process information in the concatenated information.

[0067] Step S33 above includes:

[0068] Step S331: The second program analyzes the filtered information to obtain the detection result of whether the DNS requests associated with each piece of information pose a threat.

[0069] In practice, the second process first filters the information assembled by the first program. After filtering out some of the assembled information, it analyzes the remaining assembled information to perform threat detection on related DNS requests. This reduces the number of DNS requests that need to be detected for threats and further improves the efficiency of DNS request monitoring.

[0070] In this embodiment, the second program performs overall filtering on the information assembled by the first program, which can improve the richness of information that the second program can rely on for information filtering, thereby enabling the second program to flexibly support multiple filtering rules for information filtering.

[0071] In some embodiments, the method further includes:

[0072] Step S37: The first program filters the currently collected information.

[0073] The current collected information includes at least one of current collected network connection information and current collected first information.

[0074] In a specific implementation, after the first program collects an information (or multiple information) at a time (or within a set time period), the first program filters the collected information. For example, after the first program collects network connection information associated with a DNS request at a current time, the first program filters the network connection information, and filters out unnecessary network connection information (for example, network connection information associated with a domain name in a preset domain name whitelist).

[0075] Step S38: The first program determines an association relationship between the filtered information and information in the cache of the first program according to whether the same process is associated.

[0076] The information in the cache of the first program includes information obtained by filtering previously collected information, and the previously collected information includes at least one of previously collected network connection information and previously collected first information.

[0077] In a specific implementation, the first program marks the cached information and the filtered information associated with a DNS request initiated by the same process as being associated (i.e., determines the association relationship therebetween). Taking the above filtered information as an example, the first program queries whether the information associated with the process (such as network connection information, process information, etc.) exists in the cache, and in the case where the information associated with the process exists in the cache, determines the association relationship between the request result and the information associated with the process in the cache, such as marking the storage location, index, and other information of the information associated with the process in the cache to indicate the association relationship therebetween.

[0078] Step S39: The first program stores the filtered information and the information in the cache in association according to the association relationship.

[0079] In a specific implementation, the first program finds the associated information in the cache for the filtered information according to the association relationship determined in the above step, and stores the filtered information in the storage area where the associated information in the cache is located, or stores the filtered information and the storage location, index, and other information of the associated information in the cache in the same storage area in the cache, thereby realizing the associated storage between the filtered information and the associated information in the cache, so as to comprehensively analyze each information collected and filtered by the first program from the granularity of the DNS request or the process by the second program subsequently.

[0080] For example, the first program can store the information collected and filtered by the first program in the cache in the form of a key-value pair, with the identification information of the process (such as PID, TGID, etc.) as the key and the information (such as the filtered network connection information and the first information) required to be stored in the cache as the value. When the first program stores the filtered information subsequently, the filtered information can be added to the value associated with the key, so as to realize the associated storage between the filtered information and the associated information in the cache.

[0081] The step S33 includes:

[0082] The step S332: The second program obtains the detection result of whether the DNS request is a threat by analyzing the information associatedly stored in the cache of the first program.

[0083] In a specific implementation, the second process can actively access the cache of the first program to obtain the information associatedly stored above, or the first program can splice the information associatedly stored in the cache and actively send the information to the second process, and then clear the data in the cache that has been sent to the second program. After obtaining the information associatedly stored, the second process analyzes the information to detect the relevant DNS request, so as to reduce the number of DNS requests required to be detected, thereby further improving the efficiency of DNS request monitoring.

[0084] In this embodiment, the first program can perform filtering after collecting the information, so that the filtering time of the information is closer to the collection time of the information, thereby improving the filtering efficiency of the information.

[0085] Optionally, the cache of the first program uses a Least Recently Used (LRU) cache eviction mechanism for information storage.

[0086] In a specific implementation, the LRU cache eviction mechanism can be realized by setting a Hash table in the cache. The Hash table can be a key-value pair data structure, so as to realize the associated storage of the data (i.e., data items) collected by the first program. For example, the first program can use the identification information of the process (such as PID, TGID, etc.) as the key (which is used to substitute into a Hash function to obtain the address of the relevant value in the Hash table), and use the information (such as the filtered network connection information and the first information) required to be stored in the cache as the value, so as to realize the associated storage of the information collected and filtered by the first program in the cache based on the Hash table.

[0087] Based on the LRU-based cache eviction mechanism, a list of recently accessed data items can be maintained in a hash table (which has a limited capacity) and the recently accessed data items are kept at the front of the list of recently accessed data items to achieve efficient data storage and access in the kernel (especially for data frequently accessed and operated in the kernel); when the data stored in the hash table exceeds the capacity limit, the least recently used data item is automatically evicted to make room for new data.

[0088] For example, a hit count can be added to each data item (or called cache item, such as network connection information and first information associated with a single process) in the hash table, and when the data stored in the hash table exceeds the capacity limit, a scan is performed on all cache items to find the one with the least hit count and delete it, such as deleting the cache item associated with a process (which is used to store network connection information and first information associated with the process) with the least access count from the hash table.

[0089] For another example, a list of recently accessed data items is maintained through a linked list, when accessing data, the function int get(int key) is used to find the value corresponding to the key in the hash table, and the corresponding node in the linked list is found and moved to the head of the linked list; when adding data (such as adding network connection information and first information associated with a process), the function void set(int key, int value) is used to update the value corresponding to the key in the hash table, if the relevant key cannot be found in the hash table, a new item is added in the hash table and the linked list, and the new item is placed at the head of the linked list, if the data stored in the hash table exceeds the capacity limit, an item is deleted from the tail of the linked list and the corresponding item is deleted from the hash table.

[0090] In this embodiment, by means of the idea of LRU (i.e. the idea that the pages used frequently in the past are likely to be used frequently in the future, and on the contrary, the pages that have not been used for a long time are likely to not be used in the future for a long period of time), the data access and storage in the kernel are optimized to further improve the efficiency of DNS request monitoring.

[0091] In some embodiments, the above step S12 comprises:

[0092] Step S121: The second program detects whether there is threat intelligence matching the network connection information associated with the DNS request according to the pre-established threat intelligence library.

[0093] The threat intelligence library includes a plurality of threat intelligence, and one of the threat intelligence includes at least one network connection information marked as existing threat. For example, one of the threat intelligence includes network connection information marked as a related machine suspected to be infected with a high-risk Trojan.

[0094] Optionally, according to actual requirements, one of the threat intelligence can further include information of a process associated with the network connection information or request result of a DNS request associated with the network connection information.

[0095] In a specific implementation, threat intelligence from different sources (such as public threat intelligence sources, private threat intelligence sources, or internal threat detection systems) can be collected in advance to establish the threat intelligence library, and a Hypertext Transfer Protocol (HTTP) interface can be configured as a query interface.

[0096] The second program can query, through the query interface, whether there is threat intelligence matching the network connection information collected by the first program in the threat intelligence library, or the second program can report the network connection information to the query server, and the query server queries, through the query interface or a processing program (such as a kafka message processing bus) configured with the query interface, whether there is matching threat intelligence in the threat intelligence library, and returns the query result to the second program.

[0097] For example, for the network connection information A reported by the second program, the query server queries that the network connection information of threat intelligence B in the threat intelligence library is the same as the network connection information A, and returns the threat intelligence B to the second program, and the second program subsequently determines that there is matching threat intelligence according to the query result.

[0098] Step S122: In a case where there is threat intelligence matching the network connection information associated with the DNS request, the second program determines that the detection result of the DNS request is existing threat.

[0099] In a specific implementation, if the network connection information associated with a DNS request matches a certain threat intelligence, it means that the DNS request is likely to have dangerous access behavior such as accessing malicious domain names, and the second program accordingly determines that the detection result of the DNS request is existing threat, so as to subsequently perform operations such as alarm (such as sending an alarm email) or process blocking on the DNS request with existing threat.

[0100] In this embodiment, the threat intelligence pre-collected by means of the threat intelligence library can eliminate the occupation of the second program computing resources by the algorithm-based DNS request detection such as DGA detection, thereby improving the threat detection efficiency of the second program on the DNS request, and further ensuring the monitoring efficiency on the DNS request.

[0101] As a possible implementation, the step S121 includes:

[0102] Step S1211: The second program detects, according to the threat intelligence library, whether there is threat intelligence matching the network connection information associated with the DNS request and within a valid period.

[0103] The valid period of the threat intelligence is determined according to the earliest collection time and / or the latest update time of the threat intelligence.

[0104] In a specific implementation, after collecting a threat intelligence from a certain threat intelligence source or a certain threat detection system, the threat intelligence library determines whether the threat intelligence has the same specific information (such as the same query domain name or the same request result) as a certain threat intelligence already stored in the threat intelligence library. If the threat intelligence has the same specific information as the certain threat intelligence already stored in the threat intelligence library, the certain threat intelligence is updated according to the threat intelligence (if the information is the same, the certain threat intelligence is updated in an overwriting or maintaining manner), and the time when the certain threat intelligence is updated is recorded. If the threat intelligence does not have the same specific information as any threat intelligence already stored in the threat intelligence library, the threat intelligence is directly stored in the threat intelligence library, and the collection time of the threat intelligence is recorded as the earliest collection time.

[0105] The threat intelligence library can subsequently determine the valid period of each threat intelligence in the threat intelligence library according to the earliest collection time and / or the latest update time of the threat intelligence based on actual business needs (such as a pre-set security level). For example, in a business scenario with a higher security level, the threat intelligence library can determine threat intelligence with an earliest collection time within the last twenty years as threat intelligence within a valid period, so as to ensure that the number of threat intelligence participating in the DNS request detection is sufficient, thereby ensuring the reliability of the DNS request detection. In a business scenario with a lower security level, the threat intelligence library can determine threat intelligence with a latest update time (and / or an earliest collection time) within the last month as threat intelligence within a valid period, so as to reduce the number of threat intelligence participating in the DNS request detection, thereby improving the efficiency of the DNS request detection.

[0106] In this embodiment, the user can flexibly determine the validity period based on the time when the threat intelligence is earliest collected and / or the time when the threat intelligence is last updated, so as to control the amount of threat intelligence participating in the detection of the DNS request, thereby making the detection of the DNS request more in line with the actual business requirements.

[0107] In some embodiments, after the step S11, the method further comprises:

[0108] Step S13: The second program matches the network connection information associated with the DNS request with the network connection information associated with the historical DNS request of the client.

[0109] In specific implementation, the second program records the DNS access behavior of the client in the recent period of time, such as recording the network connection information associated with the DNS request initiated by the client in the recent seven days, and matches the network connection information associated with the DNS request to be detected currently with the network connection information associated with the DNS request initiated by the client in the recent seven days (i.e. the network connection information associated with the historical DNS request).

[0110] Step S14: In the case that the network connection information associated with the DNS request does not match the network connection information associated with the historical DNS request of the client, the second program determines that the DNS request is a DNS request with potential threat, and gives a warning for the DNS request with potential threat.

[0111] In specific implementation, if the network connection information associated with the DNS request to be detected currently does not match the network connection information associated with the historical DNS request, it means that the DNS access behavior associated with the DNS request to be detected currently does not match the historical DNS access behavior of the client, such as the DNS request to be detected currently may query a domain name that has never been queried in history. This new DNS access behavior usually has a high risk of being attacked by malicious software, so the second program determines that the DNS request is a DNS request with potential threat and gives a warning to prompt the user to pay attention to the potential risk of the DNS request.

[0112] In some embodiments, the step S12 comprises:

[0113] Step S124: The second program detects whether the domain name in the network connection information associated with the DNS request belongs to an abnormal domain name according to a pre-configured domain name identification model or domain name identification rule.

[0114] In a specific implementation, a large amount of domain name data including normal domain name data and abnormal domain name (such as domain name generated by DGA generation mode) data can be collected in advance to construct a training data set and a verification data set of domain names. And the length, character composition, character frequency, character arrangement and other key features can be further extracted from the domain name data to train the domain name recognition model or construct the domain name recognition rule.

[0115] Optionally, before training the domain name recognition model or constructing the domain name recognition rule, the domain name data can be preprocessed, such as removing invalid domain names, marking domain name types (normal domain names or abnormal domain names), and converting domain names into a form that can be used for feature extraction and training. Then the above-mentioned key features are extracted from the preprocessed domain name data to train the domain name recognition model or construct the domain name recognition rule.

[0116] For example, a machine learning model such as Support Vector Machine (SVM), Random Forest or deep learning model can be used, the key features extracted from the preprocessed domain name data are used as model input, the corresponding labeled domain name type (normal domain name or abnormal domain name) is used as model expected output, and the machine learning model is trained to obtain a classifier (i.e. domain name recognition model) for judging whether the domain name is an abnormal domain name.

[0117] For another example, a series of rules (i.e. domain name recognition rules) for detecting abnormal patterns of key features such as domain name length, character composition, character frequency, and character arrangement can be constructed based on DGA generation mode or other rules. For example, after analyzing the length of the domain name data associated with the DGA generation mode, it is determined that the domain name generated based on the DGA generation mode is usually short, and then the domain name length below the set threshold can be used as a domain name recognition rule for detecting the abnormal pattern of domain name length.

[0118] Optionally, the trained model or constructed rule can be evaluated using the verification data set to measure the detection performance of the trained model or constructed rule by detecting accuracy, recall rate and other performance indicators, and adjusting.

[0119] Step S125: In the case where the domain name in the network connection information associated with the DNS request belongs to an abnormal domain name, the second program determines that the detection result of the DNS request is a threat.

[0120] In a specific implementation, if the domain name in the network connection information associated with the DNS request belongs to an abnormal domain name, it indicates that the DNS request is more likely to access a domain name generated by an algorithm (such as a domain name generated by malicious software, which is extremely vulnerable to attacks by malicious software, and may also indicate that the related virtual machine is stolen), and the second program accordingly determines that the DNS request is a DNS request with threats, so as to subsequently process the DNS request by means of alarm or process blocking.

[0121] In this embodiment, the second program can accurately screen out DNS requests accessing abnormal domain names through a pre-configured domain name identification model or domain name identification rule, thereby facilitating timely prevention and processing of threats such as attacks by malicious software or theft of related virtual machines.

[0122] In some embodiments, after step S11, at least one of the following steps S15 and S16 is further included, wherein:

[0123] Step S15: The first program sends the network connection information associated with the DNS request to the second program, and the second program filters the network connection information associated with the DNS request according to the set filtering rule.

[0124] In a specific implementation, the first program can directly send the collected network connection information to the second program, or splice the network connection information with other information (such as the first information described above) and then send it to the second program, and then the second program filters the received network connection information or the spliced information according to the set filtering rule.

[0125] Step S16: The first program filters the network connection information associated with the DNS request according to the set filtering rule, and sends the filtered network connection information associated with the DNS request to the second program.

[0126] In a specific implementation, the first program filters the network connection information associated with the DNS request according to the set filtering rule every time it collects the network connection information, and directly sends the filtered network connection information to the second program, or splices the filtered network connection information with associated other information (such as the first information described above) and then sends it to the second program.

[0127] The above step S12 includes:

[0128] Step S126: The second program analyzes the filtered network connection information associated with the DNS request to obtain a detection result of whether the DNS request has threats.

[0129] In a specific implementation, the second program analyzes the network connection information filtered by the first program and / or the second program to detect relevant DNS requests, thereby reducing the number of DNS requests to be detected and further improving the efficiency of DNS request monitoring.

[0130] Optionally, the filtering rule according to which the relevant program (e.g., the first program or the second program) performs filtering can include at least one of the following:

[0131] Item A-1: filtering information associated with intranet DNS requests;

[0132] Item A-2: filtering information associated with operation and maintenance DNS requests.

[0133] For item A-1, the relevant program can filter information (e.g., network connection information) containing intranet domain names to filter information associated with intranet DNS requests.

[0134] For item A-2, the relevant program can filter information matching preset whitelist information (e.g., specified operation and maintenance users, specified operation and maintenance containers, and specified operation and maintenance domain names), such as filtering information (e.g., network connection information) containing namespaces, user accounts (User Identification, UID), or domain names associated with operation and maintenance services to filter information associated with operation and maintenance DNS requests.

[0135] In this embodiment, considering that access behaviors of intranet or operation and maintenance services are generally not threatened by malicious software, the embodiment of the present application selects to filter information associated with specified intranet DNS requests or operation and maintenance DNS requests to further improve the efficiency of DNS request detection.

[0136] In some embodiments, before step S11, the method further includes:

[0137] Step S41: The first program intercepts information obtained by the first kernel function in the calling process each time the client initiates a DNS request, and periodically records the number of times the first kernel function is called.

[0138] In a specific implementation, the first program can periodically record the number of times the first kernel function is called by setting a counter, a timer, or the like.

[0139] For example, the first program can maintain a counter and determine a start record timestamp, and then during the interval between the current timestamp and the start record timestamp (i.e., in a period) that is less than a time threshold (such as 1 second), when the first kernel function is called, the first program will intercept the first kernel function to collect relevant information and make the counter value plus one; when the interval between the current timestamp and the start record timestamp reaches the time threshold, the first program will clear the counter value and determine a new start record timestamp (i.e., enter a new period) to repeat the above counting operation, thereby periodically recording the number of calls to the first kernel function.

[0140] Step S42: The first program determines whether the number of calls to the first kernel function recorded in the current period is greater than a set number threshold.

[0141] In specific implementation, the first program determines whether the number of calls to the first kernel function recorded in the current period is greater than a set number threshold (such as one thousand) to measure the frequency of the client initiating DNS requests, so that when the frequency of the client initiating DNS requests is too high, relevant processing operations can be performed in time.

[0142] Step S43: In the case where the number of calls to the first kernel function recorded in the current period is greater than the set number threshold, the first program no longer intercepts the information obtained by the first kernel function in the calling process in the current period.

[0143] In specific implementation, if the number of calls to the first kernel function recorded in the current period is greater than the set number threshold, it indicates that the frequency of the client initiating DNS requests is too high, and the first program then starts DNS message frequency limiting in the current period, i.e., stops intercepting information of the first kernel function in the current period, to prevent too frequent information collection from affecting the normal operation of relevant business services of the client. When entering the next period, the first program closes the DNS message frequency limiting and continues to intercept information of the first kernel function, to realize efficient monitoring of DNS requests.

[0144] In some embodiments, the above step S11 comprises:

[0145] Step S111: The first program intercepts the information obtained by the first kernel function in the calling process.

[0146] In specific implementation, the first program can intercept information of kernel functions such as udp_recvmsg as the first kernel function to obtain UDP data and other information obtained by the first kernel function.

[0147] Step S112: The first program screens data matching the port required to be accessed by the DNS request from the intercepted information, and determines the screened data as the network connection information associated with the DNS request.

[0148] In a specific implementation, the port required to be accessed by the DNS request can be determined according to an actual application scenario. For example, considering that the port number of the DNS is usually 53 or 5353, the information related to the port number of the target port (i.e., the accessed port) being 53 or 5353 can be screened from the information obtained by the first kernel function in the calling process, so as to quickly obtain the network connection information associated with the DNS request.

[0149] In this embodiment, the information obtained by intercepting the first kernel function is quickly screened through the port, which can further guarantee the collection efficiency of the network connection information associated with the DNS request.

[0150] It should be noted that, for the method embodiments, in order to simply describe, they are all described as a series of action combinations, but those skilled in the art should know that the embodiments of the present application are not limited to the order of the described actions, because according to the embodiments of the present application, certain steps can be performed in other order or at the same time. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the actions involved are not necessarily the necessary of the embodiments of the present application.

[0151] Figure 4 is a structural schematic diagram of a domain name system request monitoring device according to an embodiment of the present application. The device comprises:

[0152] The first collection module is configured to collect the network connection information associated with the domain name system (DNS) request by intercepting information obtained by a first kernel function in a calling process, wherein the first kernel function comprises a kernel function required to be called when the client initiates the DNS request.

[0153] The first detection module is configured to obtain a detection result of whether the DNS request is a threat by analyzing the network connection information associated with the DNS request.

[0154] By configuring the first program to intercept information of the first kernel function related to the DNS request, the network connection information required for DNS request threat detection can be collected at the kernel level, so that the information collection position is closer to the information generation position, thereby improving the information collection efficiency in the DNS request monitoring process. Then, by configuring the second program to analyze the information collected by the first program in a timely manner, the threat detection function of the DNS request is realized, so as to realize efficient monitoring of the DNS request by means of cooperation between the programs running at different working levels (i.e., the kernel mode and the user mode).

[0155] Optionally, the apparatus further comprises:

[0156] The first processing module is configured to determine, according to the obtained detection result, a DNS request with a threat.

[0157] The first blocking module is configured to filter, from a first process, a process that initiates the DNS request with the threat as a second process, and request the first program to block the second process, the first process including a process that has initiated a DNS request in the client.

[0158] Optionally, the apparatus further comprises:

[0159] The second collection module is configured to collect first information, the first information including at least one of a request result of the DNS request and information of a first process, the first process including a process that has initiated a DNS request in the client.

[0160] The first detection module includes:

[0161] The first detection submodule is configured to obtain a detection result of whether the DNS request has a threat by analyzing network connection information associated with the DNS request and the first information.

[0162] Optionally, the apparatus further comprises:

[0163] The first matching module is configured to match the first information associated with the same process and the network connection information associated with the DNS request with each other.

[0164] The first sending module is configured to splice each of the mutually matched first information and the network connection information associated with the DNS request, and send each of the spliced information to the second program.

[0165] The first filtering module is configured to filter each of the spliced information.

[0166] The first detection module includes:

[0167] The second detection submodule is configured to analyze the filtered information to obtain a detection result of whether the DNS request associated with the information is a threat.

[0168] Optionally, the apparatus further comprises:

[0169] The second filtering module is configured to filter the currently collected information, the currently collected information comprising at least one of currently collected network connection information and currently collected first information.

[0170] The first processing module is configured to determine an association between the filtered information and information in a cache of the first program according to whether the same process is associated, the information in the cache of the first program comprising information obtained by filtering previously collected information, the previously collected information comprising at least one of previously collected network connection information and previously collected first information.

[0171] The first storage module is configured to store the filtered information and the information in the cache in association according to the association.

[0172] The first detection module comprises:

[0173] The third detection submodule is configured to analyze the information stored in association in the cache of the first program to obtain a detection result of whether the DNS request is a threat.

[0174] The cache of the first program adopts a least recently used cache eviction mechanism to store information.

[0175] Optionally, the first information comprises a request result of the DNS request; and the second collection module comprises:

[0176] The third collection module is configured to collect the request result of the DNS request by intercepting information obtained in a calling process of a second kernel function, the second kernel function comprising a kernel function required when the client receives the request result of the DNS request.

[0177] Optionally, the first detection module comprises:

[0178] The fourth detection submodule is configured to detect, according to a threat intelligence library established in advance, whether there is threat intelligence matching the network connection information associated with the DNS request, the threat intelligence library comprising a plurality of threat intelligence, one of the threat intelligence comprising one network connection information marked as a threat.

[0179] The fifth detection submodule is configured to determine that the DNS request is a threat in a case where threat intelligence matching the network connection information associated with the DNS request exists.

[0180] Optionally, the fourth detection submodule comprises:

[0181] The sixth detection submodule is configured to detect, according to the threat intelligence library, whether threat intelligence matching the network connection information associated with the DNS request and within a valid period exists.

[0182] The valid period of the threat intelligence is determined according to the earliest time point at which the threat intelligence is collected and / or the latest time point at which the threat intelligence is updated.

[0183] Optionally, the apparatus further comprises:

[0184] The second matching module is configured to match the network connection information associated with the DNS request with the network connection information associated with the historical DNS request of the client.

[0185] The first warning module is configured to determine, in a case where the network connection information associated with the DNS request does not match the network connection information associated with the historical DNS request of the client, that the DNS request is a DNS request with potential threats, and to perform warning on the DNS request with potential threats.

[0186] Optionally, the first detection module comprises:

[0187] The second detection module is configured to detect, according to a preconfigured domain name recognition model or domain name recognition rule, whether the domain name in the network connection information associated with the DNS request belongs to an abnormal domain name.

[0188] The third detection module is configured to determine that the DNS request is a threat in a case where the domain name in the network connection information associated with the DNS request belongs to an abnormal domain name.

[0189] Optionally, the apparatus further comprises at least one of:

[0190] The second processing module is configured to send the network connection information associated with the DNS request, and to filter the network connection information associated with the DNS request according to a set filtering rule.

[0191] The third processing module is configured to filter the network connection information associated with the DNS request according to a set filtering rule, and to send the filtered network connection information associated with the DNS request.

[0192] The first detection module comprises:

[0193] The seventh detection submodule is configured to obtain a detection result of whether the DNS request is a threat by analyzing network connection information associated with the filtered DNS request.

[0194] The filtering rule comprises at least one of the following:

[0195] Filtering information associated with the intranet DNS request;

[0196] Filtering information associated with the operation and maintenance DNS request.

[0197] Optionally, the apparatus further comprises:

[0198] The fourth processing module is configured to intercept information obtained by the first kernel function in the calling process each time the client initiates a DNS request, and periodically record the number of times of calling the first kernel function.

[0199] The first judgment module is configured to judge whether the number of times of calling the first kernel function recorded in the current period is greater than a set number threshold.

[0200] The fifth processing module is configured to, in the case that the number of times of calling the first kernel function recorded in the current period is greater than the set number threshold, the first program no longer intercepts information obtained by the first kernel function in the calling process in the current period.

[0201] Optionally, the first collection module comprises:

[0202] The first collection submodule is configured to intercept information obtained by the first kernel function in the calling process.

[0203] The first screening module is configured to screen data matched with a port required to be accessed by a DNS request from the intercepted information, and determine the screened data as network connection information associated with the DNS request.

[0204] Optionally, the apparatus further comprises:

[0205] The first generation module is configured to generate alarm information and / or a log according to network connection information associated with the detected DNS request with a threat.

[0206] It should be noted that the apparatus embodiment is similar to the method embodiment, and thus the description is relatively simple, and the related parts can be referred to the method embodiment.

[0207] The application embodiment further provides an electronic device, such as a server. Figure 5As shown, the terminal includes a processor 501, a communication interface 502, a memory 503 and a communication bus 504, wherein the processor 501, the communication interface 502 and the memory 503 complete communication with each other through the communication bus 504,

[0208] The memory 503 is configured to store a computer program.

[0209] The processor 501 is configured to execute the program stored in the memory 503, and implement the steps of the domain name system request monitoring method disclosed in the embodiments of the present application.

[0210] The communication bus mentioned above can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, Figure 5 Only one thick line is used in the figure to represent the communication bus, but it does not mean that there is only one bus or only one type of bus.

[0211] The communication interface is configured to complete communication between the terminal and other devices.

[0212] The memory can include a Random Access Memory (RAM) and can also include a non-volatile memory, for example, at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0213] The processor mentioned above can be a general-purpose processor, including a central processing unit, a Network Processor (NP), etc. The processor can also be a Digital Signal Processing (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0214] The embodiments of the present application further provide a computer readable storage medium, which has a computer program / instruction stored thereon, and the computer program / instruction is executed by a processor to implement the domain name system request monitoring method disclosed in the embodiments of the present application.

[0215] In the embodiments described above, all or some of the steps can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, all or some of the steps can be implemented in the form of one or more computer programs or program elements. The computer programs reside (at least temporarily) in a memory of a computer during execution. The memory can be a RAM memory, a flash memory, a ROM memory, an EPROM memory, or any other suitable memory. The memory can be integral to or separate from the computer. The computer programs can be written in any suitable programming language, such as C, C++, Java, Visual Basic, etc. The computer programs can be written in assembly or machine language, if desired. The computer programs can be distributed over network coupled file servers, or can be distributed by any other suitable means.

[0216] It is to be noted that, in the present document, relational terms such as first and second and the like can be used solely to distinguish one entity or action from another entity or action without necessarily implying any actual relationship or order between such entities or actions. Also, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus. In other words, the terms "comprises", "comprising", or any other variations thereof, merely specify the presence of the defined elements, but do not preclude the presence or addition of one or more other elements.

[0217] Each of the embodiments described in the present specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other. Each of the embodiments mainly describes the difference from other embodiments. In particular, the system embodiments are described simply because they are basically similar to the method embodiments, and the same or similar parts can be referred to the description of the method embodiments.

[0218] The above merely provides the preferred embodiments of the application, and not intended to limit the protection scope of the application. Any modification, equivalent replacement, improvement, and the like made within the principle and technical scope of the application shall fall into the protection scope of the application.

Claims

1. A method of domain name system request monitoring, the method comprising: The method is executed by a target program configured on a client, the target program comprising a first program running in a kernel mode and a second program running in a user mode, and the method comprises: The first program collects network connection information associated with a domain name system (DNS) request by intercepting information obtained in a calling process of a first kernel function, the first kernel function comprising a kernel function required to be called when the client initiates the DNS request; The second program obtains a detection result of whether the DNS request is a threat by analyzing the network connection information associated with the DNS request; Before the second program obtains the detection result of whether the DNS request is a threat by analyzing the network connection information associated with the DNS request, the method further comprises: The first program collects first information, the first information comprising at least one of a request result of the DNS request and information of a first process, the first process comprising a process that has initiated the DNS request in the client; The first program matches the first information associated with the same process and the network connection information associated with the DNS request with each other; The first program splices each of the first information and the network connection information associated with the DNS request matched with each other, and sends each of the spliced information to the second program; The second program filters the spliced information; In a case where the second program completes filtering of the spliced information, the second program obtains the detection result of whether the DNS request is a threat by analyzing the network connection information associated with the DNS request, comprising: The second program obtains the detection result of whether the DNS request associated with each of the filtered information is a threat by analyzing each of the filtered information.

2. The method of claim 1, wherein, After the second program obtains the detection result of whether the DNS request is a threat by analyzing the network connection information associated with the DNS request, the method further comprises: The second program determines a DNS request that is a threat according to the obtained detection result; The second program screens a process that initiates the DNS request that is a threat from a first process as a second process, and requests the first program to block the second process, the first process comprising a process that has initiated the DNS request in the client.

3. The method of claim 1, wherein, The method further comprises: The first program filters current collected information, the current collected information comprising at least one of current collected network connection information and current collected first information; The first program determines an association relationship between filtered information and information in a cache of the first program according to whether the same process is associated, the information in the cache of the first program comprising information obtained by filtering previously collected information, the previously collected information comprising at least one of previously collected network connection information and previously collected first information; The first program stores the filtered information and the information in the cache in association according to the association relationship. In a case where the first program completes the associated storage of the filtered information and the information in the cache, the second program obtains a detection result of whether the DNS request is a threat by analyzing network connection information associated with the DNS request, including: The second program obtains a detection result of whether the DNS request is a threat by analyzing information associated stored in the cache of the first program. The cache of the first program uses a least recently used cache eviction mechanism to store information.

4. The method of claim 1, wherein, The first information includes a request result of the DNS request. The first program collects first information, including: The first program collects a request result of the DNS request by intercepting information obtained in a calling process of a second kernel function, and the second kernel function includes a kernel function required when the client receives the request result of the DNS request.

5. The method of claim 1, wherein, In a case where a threat intelligence library is pre-established, the second program obtains a detection result of whether the DNS request is a threat by analyzing network connection information associated with the DNS request, including: The second program detects whether there is threat intelligence matching the network connection information associated with the DNS request according to the pre-established threat intelligence library, and the threat intelligence library includes a plurality of threat intelligence, and one threat intelligence includes one network connection information marked as a threat. In a case where there is threat intelligence matching the network connection information associated with the DNS request, the second program determines that the detection result of the DNS request is a threat.

6. The method of claim 5, wherein, The second program detects whether there is threat intelligence matching the network connection information associated with the DNS request according to the threat intelligence library, including: The second program detects whether there is threat intelligence matching the network connection information associated with the DNS request and within a valid period according to the threat intelligence library. The valid period of the threat intelligence is determined according to the earliest time when the threat intelligence is collected and / or the latest time when the threat intelligence is updated.

7. The method of claim 1, wherein, After the first program collects network connection information associated with a domain name system (DNS) request by intercepting information obtained in a calling process of a first kernel function, the method further includes: The second program matches the network connection information associated with the DNS request with network connection information associated with historical DNS requests of the client. In a case where the network connection information associated with the DNS request does not match the network connection information associated with the historical DNS requests of the client, the second program determines that the DNS request is a DNS request with potential threats, and performs a warning for the DNS request with potential threats.

8. The method of claim 1, wherein, In a case where a domain name recognition model or domain name recognition rules are pre-configured, the second program obtains a detection result of whether the DNS request is a threat by analyzing network connection information associated with the DNS request, including: The second program detects whether the domain name in the network connection information associated with the DNS request belongs to an abnormal domain name according to a pre-configured domain name identification model or domain name identification rule; In a case where the domain name in the network connection information associated with the DNS request belongs to an abnormal domain name, the second program determines that the detection result of the DNS request is a threat.

9. The method of claim 1, wherein, After the first program collects the network connection information associated with the DNS request by intercepting information obtained by the first kernel function in a calling process, the method further comprises: The first program sends the network connection information associated with the DNS request to the second program, and the second program filters the network connection information associated with the DNS request according to the set filtering rule; And / or, the first program filters the network connection information associated with the DNS request according to the set filtering rule, and sends the filtered network connection information associated with the DNS request to the second program; In a case where the second program completes filtering of the network connection information associated with the DNS request, and / or the second program receives the filtered network connection information associated with the DNS request, the second program analyzes the network connection information associated with the DNS request to obtain a detection result of whether the DNS request is a threat, comprising: The second program analyzes the filtered network connection information associated with the DNS request to obtain a detection result of whether the DNS request is a threat; The set filtering rule comprises at least one of the following: Filtering out information associated with intranet DNS requests; Filtering out information associated with operation and maintenance DNS requests.

10. The method of claim 1, wherein, Before the first program collects the network connection information associated with the DNS request by intercepting information obtained by the first kernel function in a calling process, the method further comprises: The first program intercepts information obtained by the first kernel function in a calling process each time the client initiates a DNS request, and periodically records the number of calls of the first kernel function; The first program determines whether the number of calls of the first kernel function recorded in the current period is greater than a set number threshold; In a case where the number of calls of the first kernel function recorded in the current period is greater than the set number threshold, the first program no longer intercepts information obtained by the first kernel function in a calling process in the current period.

11. The method of claim 1, wherein, The first program collects the network connection information associated with the DNS request by intercepting information obtained by the first kernel function in a calling process, comprising: The first program intercepts information obtained by the first kernel function in a calling process; The first program screens data matched with a port required to be accessed by the DNS request from the intercepted information, and determines the screened data as the network connection information associated with the DNS request.

12. The method of any one of claims 1-11, wherein, The first program includes a kernel function required to intercept information, and an extended Berkeley packet filter (eBPF) program set.

13. The method of any one of claims 1-11, wherein, After the second program obtains the detection result of whether the DNS request is a threat by analyzing network connection information associated with the DNS request, the method further includes: The second program generates alarm information and / or logs according to the network connection information associated with the detected DNS request that is a threat.

14. An electronic device, comprising: The computer device comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus. The memory is used for storing a computer program. The processor is used for executing the program stored in the memory to realize the domain name system request monitoring method in any one of claims 1 to 13.

15. A computer readable storage medium having stored thereon computer programs / instructions, characterized in that, The computer program / instruction is executed by the processor to realize the domain name system request monitoring method in any one of claims 1 to 13.

Images